On Feb 4, 2004, at 12:14 PM, Paul.Wasik@xxxxxxx wrote:
I've captured some Ethernet traces with Ethereal and on many of the ARP
replies, I see an FCS of 0x888888 which it indicates is incorrect.
What I'm
trying to figure out is if this is real or being caused by the NIC on
my
laptop. I tried using a hardware sniffer with promiscuous NICs and I
don't
see this.
Can incorrect FCS indications in Ethereal be caused by the NIC
hardware /
driver used on the host machine Ethereal is running on?
Yes, but it can also be caused by the driver for your NIC gratuitously
returning a packet with 4 extra non-FCS bytes at the end of the packet,
so that Ethereal, when attempting to figure out whether the packet has
an FCS or not - some drivers *do* supply an FCS, but, unfortunately,
the packet capture mechanisms used by libpcap currently have no way of
indicating whether the packet includes an FCS or not - thinks it has an
FCS.
At some point there will probably be a preference setting to control
whether to assume all packets in an Ethernet capture where the capture
file doesn't explicitly or implicitly indicate whether an FCS is
present have an FCS, assume no packets have an FCS, or guess based on
packet length.
At some point, probably after that, there might be a way for at least
some packet capture mechanisms to explicitly specify whether the packet
has an FCS or not, although that won't make the need for the preference
setting go away (old capture files will still exist, as will old
versions of OSes, without that facility in their packet capture
mechanisms).